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In this paper we introduce the concept of quantum private channel within the continuous variables 
framework (CVPQC) and investigate its properties. In terms of CVPQC we naturally define a 
"maximally" mixed state in phase space together with its explicit construction and show that for 
increasing number of encryption operations (which sets the length of a shared key between Alice 
and Bob) the encrypted state is arbitrarily close to the maximally mixed state in the sense of the 
Hilbert-Schmidt distance. We bring the exact solution for the distance dependence and give also 
a rough estimate of the necessary number of bits of the shared secret key (i.e. how much classical 
resources are needed for an approximate encryption of a generally unknown continuous-variable 
state). The definition of the CVPQC is analyzed from the Holevo bound point of view which 
determines an upper bound of information about an incoming state an eavesdropper is able to get 
from his optimal measurement. 
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I. INTRODUCTION 

The task of quantum state encryption 0, 0, Q (quantum Vernam cipher, quantum one-time pad) is defined as 
follows. Let's suppose that there are two communicating parties, Alice and Bob, and Alice wants to send an arbitrary 
unknown quantum state to Bob (the state needn't to be known either Alice or Bob). They are connected through 
the quantum channel which is accessible to Eve's manipulations. To avoid any possible information leakage from 
the state to Eve (via some kind of generalized measurement or state estimation) Alice and Bob share a secret and 
random string (classical key) of bits by which Alice chooses a unitary operation from the given (and publicly known) 
set. The transformed state is sent to Bob via the quantum channel who applies the same operation to decrypt the 
state. For an external observer (e.g. Eve) the state on the channel is a mixture of all possible transformations that 
Alice can create because she doesn't know the secret string. If, moreover, the mixture is independent on the state to 
be encrypted then Eve has no chance to deduce any information on the state. We say that the state was perfectly 
encrypted. After the formalization of this procedure we get the definition of private quantum channel - PQC |3|. As 
the mixture it is advantageous to choose a maximally mixed state - identity density matrix. 

It is natural to ask how many operations are needed for encryption of a fc-qubit input state. Based on thoughts 
on entropy it was shown |2| and later generalized |3| for PQC with ancilla that 2k classical bits are sufficient (i.e. 
2 2k operations). Generally for perfect encryption of <i-dimcnsional quantum state d 2 unitary operations are needed. 
Thus, the length of participant's secret and random key must have at least 21ogd bits [34j. After weakening the 
security definition an approximate secrecy was stated in |4[ defining of approximate private quantum channel - aPQC. 
Then, it was shown that asymptotically just dlogd operations are needed for approximate quantum state encryption. 
Next progress in this research topic was achieved in [j| where a polynomial algorithm for constructing a set of 
encryption/decryption operations suitable for aPQC was presented. 

In this paper we investigate the possibility of quantum state encryption for continuous variables (CV) jfj. Under 
CV we understand two conjugate observables such as e.g. position and momentum of a particle. Especially we 
concentrate on coherent states states which Wigner function has the form of the normalized Gaussian distribution. 
Gaussian states are the most important class of CV states used in quantum communication and computation |7|. 
The most of intriguing processes and algorithms discovered for discrete d-level quantum systems were also generalized 
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for CV. Among others, let's mention CV quantum state teleportation |8|, |9|, CV quantum state cloning [10| and 
quantum computation with CV Importantly, a great progres s was made in quantum key distribution (QKD) 

based on CV where theoretical groundwork was laid 0, Il3l 11411151 fl(| and experiments were performed flU lisj . 

After brief introducing into the questions of distances used in quantum information theory in Sec.[H]the main part 
follows in Sec. IIIII and Sec. IIVI There we present the notion of CV quantum state encryption and in the later we 
define a continuous- variable private quantum channel (CVPQC). This, foremost, consists of defining the "maximally" 
mixed state within the context of continuous variables and estimating the length of a secret shared key between Alice 
and Bob for a given secrecy (by secrecy it is meant the HS distance between "maximally" mixed and the investigated 
state). In Sec. IIVI we will touch the question of "maximality" of the mixed state (from now on, let's omit the 
apostrophes) in the context of bosonic channels [Til l2*cj and their generalized lossy |2J and Gaussian relatives • 
We will also discuss important differences between discrete and CV encryption from the viewpoint of eavesdropping 
followed by the calculation of the Holevo bound limiting information accessible to Eve from the encrypted channel. 
Necessary Appendices come at the end of the paper. In Appendix [S] we give a derivation of the exact formula for the 
HS distance. The object of Appendix iBl is to inference the mentioned estimate of the HS distance. 



II. MEASURES OF QUANTUM STATES CLOSENESS 

Quantum states can be distinguished in the sense of their mutual distance. The distance is usually induced by a 
norm defined on the space of quantum states. This is the case of Schatten p-norm 

\\A\\ p = (Tr(\A\ p ))>=(Tr(A*))$, (1) 

where \A\ = V A^A and the last equation is valid for A = A^ . If A = gi — Q2 the Hermiticity of A is still preserved 
and for p = 2 we get the Hilbert-Schmidt (HS) distance 

Dhs(qi,Q2) = || - £2 ||a = V Tr ((ei - Qz) 2 )- ( 2 ) 
On the other hand, there is a whole family of distances based on Uhlmann's fidelity |2^| 

^(p 1 ,p 2 ) = Tr((V^P2v^r) i )- (3) 

One of them is Bures distance [24j 



D B ( Ql , Q2 )= (^2-2Tr^^> 2V ^r) (4) 

which coincides with the HS distance if gi, gi are pure states. 

There is a certain equivocation which distance is more suitable for a given task in QIT where a general problem 
of quantum state distinguishability or closeness has to be resolved. Both distances have many useful properties and 
they are subject of detailed investigation (2(|. For example, output "quality" of a quantum state in the problem of 
universal quantum-copying machine was first analyzed with the help of the HS distance [271 ] and later revisited from 
the viewpoint of the Bures and trace distance (Schatten p-norm (JIJ for p = 1) [28|. Other problem, among others, 
where closeness of two quantum states plays a significant role is quantum state estimation [2!| . Here the closeness of 
estimated states is often measured by the HS distance 

The motivation for usingthe HS distance in our calculation is two-fold. First, the security criterion for approximate 
quantum state encryption [4j is based on the operator distance induced by operator norm (p — > 00 in lJT]l) while some 
other results therein are calculated for the trace distance which is in some sense weaker than the operator distance 
(the reason is computational difficulty). Second, for our purpose we need to calculate distance between two infinitely- 
dimensional mixed states what is difficult in the case of all fidelity based distances. However, we suppose that the 
HS distance is a good choice for coherent states and provides an adequate view on measure of the closeness of two 
states. 
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III. CV STATE ENCRYPTION AND ITS ANALYSIS 



Let's define the task of CV state encryption. As in the case of discrete variable quantum state encryption, Alice and 
Bob are interconnected via a quantum channel which is fully accessible to Eve's manipulations. Both legal participants 
share a secret string of random bits (key) which sufficient length is, among others, subject of this paper. The key 
indexes several unitary operations which Alice/Bob chooses to encrypt/decrypt single- mode coherent states. The 
purpose of the encryption is to secure these states from leakage of any information about them to an eavesdropper 
(Eve). The way to achieve this task is to "randomize" every coherent state to be close as much as possible to a 
maximally mixed state (maximally in the sense specified next). The randomization is performed with several publicly 
known unitary operations (it is meant that the set from which participants choose is known but the particular 
sequence of operations from the set is given by the key which is kept secret). So, suppose that Alice generates or 
gets an arbitrary and generally unknown single-mode coherent state. The only public knowledge about the state is 
its appearance somewhere inside the circle of radius b in phase space with the given distribution probability. Here we 
suppose that states occur with the same probability for all r < b and with zero probability elsewhere. 

Suppose for a while that Alice encrypts a vacuum state. This situation will be immediately generalized with the 
help of the HS distance properties for an unknown coherent state within the circle of radius b as stated in the previous 
paragraph. The first problem we have to tackle is the definition of a maximally (or completely) mixed state. Here the 
situation is different from, generally, <i-dimensional discrete Hilbert space where a normalized unit matrix is considered 
as the maximally mixed state. This is inappropriate in phase space nevertheless we may inspire ourselves in a way the 
discrete maximally mixed state is generated. In fact, we get the maximally mixed state (in case of qubits gv = £Viv) 
by integrating out over all density matrix populating the Bloch sphere 1 cx J gydV (irrespective of the fact that the 
finite number of unitary operations suffice for this task as the theory of PQC learns). Similarly, as a maximally mixed 
state j35] we can naturally choose an integral performed over all possible single-mode states within the circle of radius 
r < b ' 
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| a) = D(a) |0) = cxp(— |a| 2 /2) X^^Lo "T^T \ n ) 1S a corieren t state represented as a displaced vacuum via the displace- 
ment operator D(a) (from now on it will not be mentioned explicitly that \a\ < b for all displacement operators used 
in this paper and for given 6) and C — irb 2 is a normalization constant. Note that calculation Q for b — > co without 
the normalization is nothing else than well known resolving of unity giving the evidence of spanning the whole Hilbert 
space. 

Having defined the maximally mixed state let's investigate which operations Alice uses for encryption. This trans- 
formation should be as close as possible to the maximally state in the HS distance sense and the closeness will depend 
on the number of used operations. Beforehand, we will note how to facilitate forthcoming tedious calculations on a 
sample example. Suppose that Alice has e.g. four encryption operations, which displace the vacuum state to the same 
distance from the origin but under four different angles (from symmetrical reason these angles are multiples of ^ 
in this case). Alice chooses these operations with the same probability. Now, if we write down the overall mixture 
from the states, it can be shown that there exists a computationally advantageous "conformation" when the mixture 
reads 



= -El«4,)(a 4g |=exp(-^) -7=HMC', (6) 

q= 1 m,n— 



where ml = m + 41, I = 1, . . . , oo and 8™ = 1 for all m (occupation number) else 5™ = 0. Informally, © is always a 
real density matrix with off-diagonal non-zero "stripes" separated from main diagonal and from a neighbouring stripe 
by three zero off-diagonals. Q4 acquires relatively simple form J^J if a iq = ne 19 ^ 4 " for -d iq = j + (q — 1)^-. This can 
be generalized for arbitrary number of states dispersed on a circle with given radius r p 

1 P 00 r m+n 

Q P = -J2\ a P^ a Pi\= e M-r 2 p ) E -j==\m)(n\5™ , (7) 
p — ; — ' v mini 
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where p £ Z + ,m' — m + pl and <$™ is denned as before. Favorable "p-conformations" Q occur when a pg = r p e lq ' dlpq 
for i? pg = ^(2q — 1). Now, we may proceed to the mixture characterizing all Alice's encryption operations. She chooses 
N > 1 and defines r p = pb/N for p = 1, . . . , N. Then 

, JV N p 

® n = = j^EE^mi^oi^k?) ( g ) 

p— 1 P=l 9=1 

with normalization M = ^YI^+ll Xo sum up the protocol, Alice and Bob share a secret and random key which indexes 
their operations. So, Alice equiprobably chooses from the set of M displacement operators D(a pq ) = exp(a pq a^ — a* q a) 
where just one operator creates a coherent state on the circle of radius n, two operators generate two states on the 
circle of radius r2 and so forth up to N. Mixtures of the states on particular circles are in favourable form and 
the whole state is (JSJ. The rest of the protocol is the same as in discrete state encryption. Alice sends the encrypted 
state through a quantum channel towards Bob who makes Alice's inverse operation to decrypt the state. 

The keystone in quantum state encryption both discrete and CV is the fact that an unknown and arbitrary state can 
be encrypted. If the state was known we would't need this procedure at all because Alice could just send information 
about the preparation of the state to Bob. So, it would suffice to encrypt this classical information with the Vernam 
cipher. Also, our definition of CVPQC must be independent on the state which is to be encrypted. To provide this we 
will find useful unitary invariance of the HS distance Dh${q, &) = Dhs{U qU', UaU^) for an arbitrary unitary matrix 
U . This invariance is, however, necessary but not sufficient condition for our purpose. The second important issue 
is due to advantageous algebraic properties of displacement operators. Let's demonstrate it on Alice's encryption 
algorithm which stays the same as before. If she gets an arbitrary coherent state \(3) (|/3| < b) she randomly chooses 
one from M displacement operators D(a pq ) (as the shared key with Bob dictates). Then, even if two displacement 
operators generally do not commute we may write a general encryption TPCP (trace-preserving completely positive) 
map 

N p N p 

p—1 q—1 p—1 q—1 

(9) 

It is obvious that generally £ N {\P)) ^ ®n (and similarly / D(a)\/3)(l3\D j < {a)d 2 a cx D{(3)t b D^ '(/?) = if ^ t b ) but 
their HS distances are equivalent, i.e. Dhs{^ ,£ n{\P))) = Djjs(lb, $jv)' Thus, we are henceforth entitled to make 
all calculations of the HS distance between if and £jv(|/3)) with explicit forms JSJ and (|SJ. After some calculations 
we will see (Appendix 01 that 

D 2 HS (±l£ N {\(3))) « (^y) 2 + O (iV- 4 ) , (10) 

which holds for all for all input coherent states \(3). The guess (|1(J|) is far from optimal (e.g. independent on b) and is 
not even an inequality. But this doesn't matter because the exact form can be derived (for details see Appendix lA"|l . 
Its only problem is relative complexity so we cannot easily deduce the number of operations for a given level of secrecy. 
Nevertheless, (|10|) asymptotically approaches to the exact expression (as is shown in Appendix[BJ) . Notice that in spite 
of the derivation of (|10fl (or, next, analytical expression l|12|)) we still cannot reasonably define a CVPQC. We will do 
so in section llVl after presenting another assumptions regarding eavesdropping on our private quantum channel. 
If we consider the described unitary invariance of the HS distance we write down lhs of (|10|) 



D 2 HS (l b , Q N ) = Tr ((1 6 - $ w ) 2 ) = Tr (lg) - 2 Tr (l 6 $ w ) + Tr 



(11) 
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After some calculations (see mentioned Appendix we get a little bit lengthy expression 



D 2 HS (t b ,$ N ) 
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(12) 



where r p = pb/N, r pi — pib/N, R\2 — P1P2 {b/N) 2 and J„(a;) is a modified Bessel function of the first kind of order 



/„M = £(f) 



n+2s 



s=0 



(n + s)\s\ 



(13) 



However, as we declared, for a rough estimation of the number of operations for a given secrecy we will employ l|10|l . 



Using M 



N(N+1) 



(N+l) 



(and then again M 



) we find that the dependence of the number of bits on the 



HS distance iff^l is n = log M = —2(1 + log Dhs) + log + \/T+ CD 2 H ^j » -1 - 2 log Z?#s because the guess is in 

particular precise for D^rs « 1. C is a constant (polynomial) bounding 7V~ 4 in (|1(J|) from above. By the numerical 
simulations based on 112fl for different b and M we see that the guess is accurate and for higher M even serves as a 
relatively good upper bound. 



Simplified encryption 

Now, let's see what is going to happen if we simplify our encryption protocol. The arrangement is the same, 
i.e. Alice's task is to encipher single-mode coherent states and her only knowledge is that the states are somewhere 
inside the circle of radius r < b. However, Alice's technology is limited and we will tend to replace technologically 
demanding displacements by simple phase shifts given by the well known time evolution \ce(t)) = exp(—iHt/h) \a) with 
the Hamiltonian H = fku(n + |). The resulting state is |a(t)) = exp(— iut/2) \a exp(— iuut)) so the state undertakes 
the rotation about Q = ut regardless the distance (which stays preserved) from the phase space origin. Note that 
unitary operator U = exp(—iHt/h) has the form 

U = exp ( — — J ^ exp(— iu>tn)\n)(n\. (14) 

Next, suppose that Alice is equipped with p encryption operations where she can rotate the state about q multiples 
of 2ir/p. So, Q q — q2n/p where q — 1, . . . ,p. Then, for someone without any information about the angle of rotation 
chosen by Alice (e.g. Eve) the state leaving Alice is in the form 



Qp 



- £ U^ap- 1 =IJ2 (l a >H), = - E \^)(ae^ | (15) 



Pi Pi P 

q—1 q—1 q—1 



where U q is (|14|) with Q q = u>t q = q2n/p. Because Alice doesn't know where exactly the state \a) is placed we cannot 
write an explicit form of g q . Apparently, however, for arbitrary p it can be transformed to our favourite state Q, 
again with the help of unitary operation l|14|) 

Q P {r P ) = U-q.U- 1 = exp(-r 2 ) £ -j==\m){n\5^ , (16) 

where ml = m + pi, I = 1, . . . , 00. It remains to show that 1& = £/l;,£/ _1 . This can be readily seen from the fact 
that l|14[l is diagonal. This is vital. Now we can easily calculate the HS distance of Q p (r p ) and If, and regarding 
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FIG. 1: (A) In the case of technologically simplified encryption Alice has at disposal just one displacement operator and 
several phase shifts. The depicted HS distances 117H (here for b — 2 and p = 1,...,20 determining the number of used 
encryption operations) illustrates how Alice chooses the proper displacement D(r m in) and a correct number of phase shifts. 
We see that for p > 6 the minimum is "saturated" so Alice needs just six phase shifts for the best approximation to full- 
encryption protocol. Another rising of p doesn't bring any advantage. The dash-dotted curve connects minima for their better 
visibility. (B) Numerical solutions of Eq. I18H for different b (i.e. growing input range of states coming to Alice) tells us which 
displacement is needed in the case of simplified encryption. For these values of r m in the HS distance 11711 reaches the lowest 
values. A special case of b — 2 is highlighted to see its correspondence with the picture on the left. 



the unitary invariance of the HS distance the result will be valid for any arbitrary input coherent state (this trick is 
akin to that one used in ©). After the calculation we get the same result as in <jT2)l but for fixed p and without the 
summation over pi , p2 

i o 1 °° / b \ k 

*> = w^m ( exp « - /0 ^ - h ^ ~ § U Ik{2rpb) 

I (2r 2 p )+2j2l P k{2r 2 p ) . (17) 




exp (2 r-2 



fc=i 



The behaviour of this quantity is completely different compared to l|12[l describing the original case as can be seen in 
Fig. ^ (A) . As an example we put 6 = 2 and we see that there exists r min < b for which the HS distance between (JSJ 
and 1)16(1 reaches its minimum for sufficiently high p. In order to find a radius minimizing the HS distance of these 
density matrices for various b (we put p — + oo and thus 2^^^ I p k (2r^) vanishes - we seek for, say, a saturated 
minimum which is independent on the number of operations on a given circle) we can calculate 
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* = exp R) [ r ™ h ( 2r — ) ~ r — /o ( 2r —) + bexp W) 1 ( ^ ) = ( 8) 

The solution is the root of the expression in parentheses. Unfortunately, an analytical solution wasn't found so 
numerical calculation of r min for several b € (0, 7) is depicted in Fig. (B). 

What are the physical consequences of this whole simplification? From Fig. ^ (A) we see that a maximally mixed 
state lb can be in the distance sense substituted with a mixture of coherent state on a circle (with radius r m i n 
where the diversion from If, is smallest) and the mixing requires relatively few encryption operations (low p for the 
distance saturation). It holds not only for 6 = 2 what is the case in the picture. So, now we can make the process 
of encryption/decryption technologically easier. We equip Alice/Bob with mentioned phase shifts leading to ll(j|) 
and just one displacement operator D(r min ). Every incoming coherent state is first displaced and then encrypted by 
choosing a phase shift (indexed by a secret key). The role of Fig.H(B) is in a proper choice of r m ;„ for given b. Finally, 
Alice examines Fig. ^ (A) to select a sufficient number p of phase shifts for which the minimum of HS distance l|17|) 
stays essentially the same. 
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The important point is that incoming coherent states come to Alice randomly and equiprobably for given b so 
after this simplified encryption (and for many encryption instances) they are as close as possible to full-fashioned 
encrypted states as they would be if processed by using (JSJ, i.e. the case of fully technologically equipped Alice and 
Bob, respectively. The overall advantage is the use of just one technologically demanding operation which doesn't 
need to be tuned for given b (it stays fixed in the encryption protocol described at the beginning of chapter . 

IV. EAVESDROPPING ON ENCRYPTED CV STATES 

Quantum channels are TPCP maps on quantum states. Following the classical channel coding theorem [3lJ one 
may ask how much information is a quantum channel able to convey. This question naturally leads to the definition of 
quantum channel capacity (for a nice survey on various quantum channel capacities see Ref. [l^]) as the maximum of 
the accessible information over the probability distributions of the input states ensemble {pi, o~i\ entering the channel 
(after classical-quantum coding onto input quantum states Xi ^ <7j the ensemble of classical messages is indicated 
by the variable X = {p(xi),Xi} where p(xi) = pi). The accessible information I acc itself is the maximization over all 
measurement of the mutual information I(X; Y) with the variable Y — {p (yj), yj} giving the probability p (yj) of the 
result yj (an output alphabet) of a measurement on the channel output. Sometimes it might be difficult to calculate 
the accessible information to determine the channel capacity. Then, we can estimate the accessible information from 
above by the Holevo bound 

x(Wi}) = s(l>*i) -l>s(0, (19) 

for which was proved |33|| that x ^ Iacc (S(g) is the von Neumann entropy) reaching equality if all Oi commute. 

In our case we try to get as close as possible to our maximally mixed state (JSJ) with TPCP map JSJl (or, generally, 
to 1^ with ©) which both belong to the class of bosonic channels 0,H3|. However, our task is quite different from 
reaching the highest quantum channel capacity (what means "tuning" of pC). Now, the variable X is fixed. For our 
purpose the Holevo bound can tell us what is the upper bound on information which is a third party (Eve) able 
to learn from her very best (that is optimal) measurement on the quantum channel. The question now is of what 
state we should calculate the Holevo bound to find Eve's maximum of attainable information on incoming states. 
Unlike the discrete case (perfect and approximate encryption) the condition of perfect and acceptable closeness of 
an encrypted state to the maximally mixed state is not in this case sufficient. Let's demonstrate the reason for this 
difference on the Bloch sphere (i.e. perfect qubit encryption). If Alice encrypts an unknown qubit (with a PQC 
compound from e.g. four Pauli matrices) she gets a maximally mixed two-qubit state (normalized unity matrix). It 
means that Eve cannot construct any measurement giving her information on the state. Moreover, even if she had a 
priori information on the state (in the sense that Alice gets and encrypts many copies of the same unknown state) 
she wouldn't be able to use any method of unknown quantum states reconstruction [2t|. She wouldn't get any clue 
where to find the state because all are transformed (encrypted) to the maximally mixed state dwelling in the center 
of the sphere. Unfortunately, this is not our case. Here, if Alice encrypts many identical coherent states (howbeit 
unknown) Eve could in principle reconstruct in which part of the phase space the encryption had been carried out. 
Because we next suppose that encryption operations are publicly known (naturally not the secret key sequence itself) 
Eve then could be able to deduce the original state from many variant ciphers of the same state. So we will suppose 
that incoming state do not exhibit such statistics and, moreover, they are distributed equiprobably and randomly in 
the whole region of considering (i.e. within the circle of radius r < b) [jjfj. Less restrictive requirement could be a 
distribution independent on the phase and changing only with the distance from the origin (rotationally invariant) 
what will be discussed at the end of this chapter. 

Based on theses thoughts, we may finally define CVPQC. We call the object {B, P B , Ml/ 3 )): as CVPQC where 
B is the set of all coherent states \0) (|/3| < b) with distribution Pg around the origin of phase space, £n(\P)) is the 
TPCP map defined in © and if is maximally mixed state centered around an input state |/3) (displaced |J5J). Let's 
note that the definition of CVPQC is valid for all coherent mixed states of the general form gp — YliPi{\P)(@\)i with 
^2iPi = 1 and \/3\i < b, Vi because of convexity of HS norm. The situation is similar as in p| for the operator norm. 

Considering the assumptions from the previous paragraph let's focus on the problem of security on the channel. 
For our purpose we employ an integral version of (I19|l . First note that we are now interested in the limiting case when 
Alice uses infinitely many encryption operations [37]]. More importantly, it remains to correctly answer the question 
posed above. That is, what actually calculate as the Holevo bound? We know that Eve will measure on the encrypted 
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FIG. 2: The Holevo bound represents an upper bound for information Eve is able to get from her best measurement on the 
encrypted channel. The bigger is the set of states coming to Alice (growing b) the more information Eve can extract. This is 
caused by better discriminability of Eve's measuring apparatus. Nevertheless, relatively low calculated values of the Holevo 
bound for our CVPQC given by Eq. Ill' II limits Eve in eavesdropping on the channel. 

channel to get any information on incoming states (states before the encryption) . To learn something about position 
of a coherent state before encryption Eve must try to distinguish among objects which preserve some information 
about input states location in phase space. In other words Eve has to choose a correct "encoding" cr, from Eq. i|19|) 
but now for a continuous index. Due to the used encryption operation (which in our case N — > oo transforms to 
lj as is proved in Appendix^) a state 1? is that object which preserves the information on placement of an incoming 



state because is centered around it. Then, a continuous version of ljT§|) reads 

x({P(/J),l£}) = S(A 2b ) - f d 2 pP((3)S(l 



(20) 



where A 2 b is a total state leaving Alice's apparatus (normalized Eq. (|22|) '). P((3) is an input distribution from the 
CVPQC definition and if = D{(3)t b D^ {(3). Since S(D{(3)t b D^ (j3)) = S(l b ) for all it immediately follows from © 



x({PG9),l£}) =S(A 2b )-S(l b ). 



(21) 



To calculate the Holevo bound (|21|l it remains to find the total state after the encryption procedure provided that 
Eve doesn't know neither which particular coherent state \(3) comes to Alice nor the key used for encryption. Thus, 
because the incoming distribution P{(3) = P(x, i9) — 1 (no need to normalize it here) is publicly known then Alice 
quite accidentally experiences 1& also as a total incoming state. So, the state leaving Alice is in the form 



A 2b = 



J d 2 aD(a) d 2 /3|/3)(/3|) &(a) = J* j\ 2 p ^ J* d 2 a£(a)|/?></3|Dt( a )j 
J xdxj ydy J dip d& \(3 + a)(f3 + a\ J = 2ir ^ J-AJ J J J dxdydip e 



R 



2n+l 



xy, (22) 



where R 2 



V 



2xy cos ip < 4b 2 , d 2 a = ydydtp, d 2 f3 — xdxdfl and D(a) are encryption displacements (again 



uniformly distributed as the CVPQC definition dictates and without a normalization). Shortly said, by changing the 
order of integration we see that A 2b is diagonal. Concretely, the term in the parentheses in the reordered integral 
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(second row in J22J)) is an ordinary coherent state \/3 + a) (r is its distance from the origin and abscissae formed by 
points in the phase space (a, (3) and (/?, 0) contain a relative angle ip) and is integrated out over the phase. This 
gives a diagonal matrix and next integrating just changes the statistics on the diagonal. Note that "covers" the 
area of radius 2b in phase space. Unfortunately, it is difficult to obtain an analytical solution of (|22[1 . Nevertheless, 
based on (1221) we may generally write (tilde indicates normalization) A26 = J2 n ^n ^\n)(n\, where A« are needed to be 
determined numerically. Inserting A 2 fc = J2 n ^\n)(n\ and JSJ into Eq. (f?T]) we find the desired Holevo bound what 
is depicted in Fig. [21 It is interesting to note that the convergence of the Holevo bound is tightly connected with the 
energy constraint J Tr (p^a^a) dPg < n& which is automatically satisfied through the finiteness of b in our CVPQC. 
For a general distribution P(/3) it is satisfied due to the natural conditi on J d 2 pP(3) = 1. The importance of the 
constraint has been already recognized for capacities of bosonic channels |l9[ l2Cll2lll2q . 

From Fig. [21 we see that there is no chance for Eve to find which coherent state actually passes on the channel. 
This is not so surprising considering the non-discrete character of the input distribution P{0). But Eve cannot divide 
the appropriate area at least roughly to approximately devise the position of a particular encrypted state 1^ (and 
from this to derive the desired position of an incoming state |/3)). From the informational point of view the Holevo 
bound results could be interpreted such that for a given b there doesn't exist any optimal measurement enabling Eve 
to divide the circle of the radius 2b in more than 2 X sections and tells her in which one the encrypted state occurs. 

Having fixed the input distribution P{0) of coherent states coming to Alice another way how to next decrease the 
Holevo bound might be a different definition of an encryption distribution in Eq. 1221) where a uniform distribution 
is implicitly used. If this distribution was symmetrical (i.e. rotationally invariant, for example Gaussian one) then 
we would find Eq. (1221) diagonal as well and thus we could easily calculate (I21[) . However, a big challenge is proving 
the optimality of such distribution function. Anyhow, it means that by minimizing the Holevo bound l|2II) within the 
context of the CVPQC definition we could tackle the previously mentioned problem of maximality of our mixed state 
by putting this more suitable distribution into Eq. (JSJ. 



V. CONCLUSION 



In this work we have opened the problem of continuous variable encryption of unknown quantum states and 
introduced the concept of private quantum channels (CVPQC) into this area. For the start we have restricted ourselves 
on coherent states which belong to the important class of states with the Gaussian distribution function. A particular 
continuous variable private quantum channel was proposed and we have studied its properties. Firstly, it means 
that we have established the notion of so called maximally mixed state with regard to its non-discrete (continuous 
variable) nature. For this kind of mixture we were interested how many encryption operations are sufficient to consider 
an incoming coherent state to be secure. This quantity was determined by calculating the Hilbert-Schmidt distance 
between the mixture and the encrypted state for an arbitrary number of encryption operations. Next, we have studied 
the possibility of eavesdropping on the quantum channel. We have supposed that Eve is able to perform an optimal 
measurement to get the maximum information on the state (which is limited by the calculated Holevo bound) or is 
able to use some quantum state estimation methods. The second possibility (which requires Eve's a priori information 
on the statistics of the states in the sense that she knows that Alice gets many copies of the same unknown coherent 
state to encrypt) restricts the CVPQC definition. The way how to avoid this kind of attack is the most desired 
direction of next research. 

Beside the above mentioned topic we have addressed many more intriguing questions which can stimulate another 
research in this area and improve the existing protocol. Among many topics let's name the problem of either universal 
distribution of incoming state or a universal distribution of encryption operations or both. This is tightly connected 
with the freedom in choice of the definition of maximally mixed state. We have seen that there exists a certain 
ambiguity in the definition of what we call here the maximally mixed state in phase space. Its relevance is measured 
by the accessible information (or eventually limited from above by the Holevo bound) Eve can get and the question 
is what kind of definition of the maximally mixed state is the most appropriate for a given incoming distribution 
of states. Together with this topics another generalization presents itself. It is the possibility to encrypt another 
Gaussian states, especially squeezed states. 
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APPENDIX A 



Eq. I|ll[l consists of three parts. Let's calculate them step by step. If we rewrite JSJ in a more suitable form we get 
diagonal elements in the form 

^") = ^)( E (AD 

Now, we may easily calculate 



to! 



, ; , _ 1 " / ~ b 2m Y _ 1 6 4 " ^ b 4n+2k N 

_ b^Mmh\h n m! 7 & 4 exp(26 2 ) ^ ( n! )a»+ ZjAjni^ + fc)!^ 

1 / °° 5 4 (" +:L ) °° °° 54(n+l)+2fe \ 1 / °° \ 

6 4 exp(2& 2 ) (^«!(« + l)! +2 ^„? 4« + Hl)! J = & 2 exp(26 2 ) \ h M + 2 E 7fe + 1 ( 26 ') J 
' (exp(2fo 2 )-/ (2& 2 )-/i(26 2 )), (A2) 



6 2 exp(2fo 2 

where I s is a modified Bessel function of the first kind of order s. The last row is due to identity 



I (x) + 2 J2 h (x) = exp(x) . (A3) 
k=i 

For the calculation of the cross element Tr (l&$jv) we use (jAlll again. But for the sake of clarity we will calculate 
only pTr (lb Bp)- The overall trace is given by summation Tr (I^n) = 1/M _ =1 pTr (lb Bp) what follows from ijHJ). 
From Q we get a general diagonal element 

pg p (n,n) =pexp(-r-p) -^-\n)(n\ (A4) 

and then 

00 00 r 2n ^2m °° °° 5 2 (™+ fc ) 



P I fc £W J.2 P ^r,(h2\ Pm ( r 2\ Zv Z^ „! m ! 7,2 PYn /f,2^ ™ n( V 2, \ Z^ Z^ 



.2" 



6 2 exp(6 2 ) exp(r 2 ) ^ 0m ±^ +1 n\ ml b 2 exp(6 2 ) exp(r 2 ) ^ n!(n + k)\ p 



1 



/ I. \ 

tUE - ^( 2 ^)- ( A5 ) 



6 2 exp(6 2 ) exp(r 2 ) ^ \ r P, 
Overall, we have 

2 1 ^ °°/6\ fe 

= AT(iV + l) & 2 e xp (6 2 ) g^xpK)E (-) J*(2r p 6). (A6) 

The third part can be written 

^ m = (^vVl)) 2 ^ ( E «Wfe<h J ( A7 ) 
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where particular summands have the form 



PiPj 



exp I ri. + r 2 



Io(2Rij) + 2 E I PiPj k{2Rij) 



(A8) 



fc=i 



Pi 1 Pj t 

what can be easily seen if we substitute (J7J into a slight generalization of (| A3|) 



7 (2xy) + 2 J k (2xy) = exp (a; 2 ) exp(y 2 ), 



(A9) 



fc=i 



where for our purpose £ = r Pi = pib/N, y = r Pj = pjb/N, Rij — piPj(b/N) z 



APPENDIX B 



When performing a limit transition it can be shown that lini/v— >oo \&n ~ li>|=0. The only nonzero elements of $n 
stays on its diagonal and are equal to diagonal elements of Let's demonstrate it on first diagonal element (n = 0). 
From and JHJl we see that 



$aK0,0) 



2n+l 



N N oo 

WTT yE P exp(-, 2 )|0)(0| = TO EEH)^ ! V° )<01 - 



(Bl) 



Assuming that 



N , d+l 

p=i p=i \ j? / 



(B2) 



where £?„ are Bernoulli numbers, inserting the highest polynomial (lower polynomials subsequently tends to 

zero) from (|B2ll into I|B1|) and finally letting N — > oo we get (omitting ketbra) 



AT 



00 L2n Ar2(n+2) 1 00 /,2n 

lim ^(0,0) = 2 lim E^ 1 )" — vin + u v Ziw ZTT = E^ 1 )"— = 1 ~ cxp(-6 2 )6 2 = 1 6 (0, 0) (B3) 
jv-k» z — j! n! N /ln+1 {Jy + 1) 2(n + 1) z ^ n! 



as can be seen from I(A1(1 . In this way we could continue for all diagonal elements of $>]y(n, n). But turn our attention 
elsewhere. If we realize that a general diagonal element is of the form 



$Ar(n, n) 



N(N + 1) 



1 W 



we see that the expression for the HS distance 1)12(1 can be simplified in the following way 

D 2 HS (l b ,* N ) = |l h -$Ar| 2 

2 



(B4) 



(B5) 



AT 

E 



-exp(2r 2 ) ^ 



EM 2 ^) + E 



v JV(JV + l) 
This form will help us in deriving 1(10(1 

oo oo 

lib - $at| = E i a "( fc < fc ) - $jv ( fc < fc )i ~ E 



x=l ex p ( r fel + ' 



7^2 



fc=0 



fc=0 



1 



N 



N + l 



ki> \n=\ 



1 



E ^feife 2 n(2i?12) 



A + 1 



(B6) 
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and hence — &n\ 2 ~ f jvTt) • We again put the highest polynomial N d ^ into ^^(k,k) and used the normal- 
ization condition X)fc°=o ^-b(k, k) = 1. Second part of (|B5|) tends to zero even faster. We can see it with the help 
of l|A9(l from which follows that X^^Li Ikn (^ r fc) ^ ex P (^ r k) especially for higher k (and, of course, similarly for the 
second summand in square brackets of expression (|B5|) ). From these considerations IjlOU follows and, not surprisingly, 
asymptotically approaches the exact value. 
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